The shift from “is this skill malicious?” to “does this skill have more permission than its job requires?” is the more important security model. A legitimate skill with unnecessary shell or credential access can become dangerous as soon as the agent processes untrusted input.

This is also where provenance and versioning become critical. In production AI work, including at IT Path Solutions, I’d want the skill version, upstream commit, effective permissions, and hardening changes tied to the agent run itself. Otherwise, when behavior changes, it’s difficult to tell whether the problem came from the model, the skill instructions, or a dependency update.

The other point worth emphasizing is that hardening and isolation solve different problems. Least privilege reduces blast radius, but it doesn’t make an agent safe to trust with arbitrary repositories. You still need execution boundaries, credential isolation, and an approval path for actions that cross those boundaries.